S3 + GitHub Actions で Turborepo Remote Cache を自前構築し、モノレポ CI を高速化した話

# 初回実行: キャッシュミス
$ turbo run build
...
Tasks: 5 successful, 5 total
Cached: 0 cached, 5 total
Time: 2m 30s
 
# 2回目実行: キャッシュヒット（変更がない場合）
$ turbo run build
...
Tasks: 5 successful, 5 total
Cached: 5 cached, 5 total
Time: 0.5s  # 劇的に高速化

# S3 バケットを作成（バケット名は一意にする必要があります）
aws s3 mb s3://your-turborepo-cache-bucket --region ap-northeast-1
 
# ライフサイクルルールを設定（古いキャッシュを自動削除）
aws s3api put-bucket-lifecycle-configuration \
  --bucket your-turborepo-cache-bucket \
  --lifecycle-configuration '{
    "Rules": [
      {
        "ID": "DeleteOldCache",
        "Status": "Enabled",
        "Filter": {},
        "Expiration": {
          "Days": 30
        }
      }
    ]
  }'

# OIDC プロバイダーの作成
aws iam create-open-id-connect-provider \
  --url https://token.actions.githubusercontent.com \
  --client-id-list sts.amazonaws.com \
  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1

// trust-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::YOUR_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:your-org/your-repo:*"
        }
      }
    }
  ]
}

// s3-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::your-turborepo-cache-bucket/*",
        "arn:aws:s3:::your-turborepo-cache-bucket"
      ]
    }
  ]
}

# IAM ロールの作成
aws iam create-role \
  --role-name turborepo-remote-cache-role \
  --assume-role-policy-document file://trust-policy.json
 
# S3 アクセスポリシーをアタッチ
aws iam put-role-policy \
  --role-name turborepo-remote-cache-role \
  --policy-name S3CacheAccess \
  --policy-document file://s3-policy.json

# .github/actions/run-remote-cache-server/action.yml
name: 'Run Remote Cache Server'
description: 'Run server for remote cache'
inputs:
  remote_cache_s3_bucket_name:
    description: 'S3 bucket name for remote cache'
    required: true
  remote_cache_role_arn:
    description: 'IAM role ARN for remote cache'
    required: true
  remote_cache_port:
    description: 'Port for remote cache server'
    required: false
    default: '34444'
  remote_cache_host:
    description: 'Host for remote cache server'
    required: false
    default: 'http://127.0.0.1'
runs:
  using: 'composite'
  steps:
    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ inputs.remote_cache_role_arn }}
        aws-region: ap-northeast-1
 
    - name: Start Turbo Cache Server
      uses: trappar/turborepo-remote-cache-gh-action@main
      with:
        storage-provider: s3
        storage-path: ${{ inputs.remote_cache_s3_bucket_name }}
        port: ${{ inputs.remote_cache_port }}
        host: ${{ inputs.remote_cache_host }}

# .github/workflows/ci.yml
name: CI
on:
  push:
    branches: [main, develop]
  pull_request:
 
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # OIDC トークンの取得に必要
      contents: read
 
    steps:
      - uses: actions/checkout@v4
 
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
 
      - name: Install dependencies
        run: npm ci
 
      # Remote Cache サーバーを起動
      - name: Run remote cache server
        uses: ./.github/actions/run-remote-cache-server
        with:
          remote_cache_s3_bucket_name: ${{ secrets.REMOTE_CACHE_S3_BUCKET_NAME }}
          remote_cache_role_arn: ${{ secrets.REMOTE_CACHE_ROLE_ARN }}
 
      # Turborepo でビルド（キャッシュが自動的に使用される）
      - name: Build
        run: npm run build
 
      - name: Test
        run: npm run test
 
      - name: Lint
        run: npm run lint

{
  "$schema": "https://turbo.build/schema.json",
  "tasks": {
    "build": {
      "dependsOn": ["^build"],
      "outputs": [
        "dist/**",
        ".next/**",
        "!.next/cache/**"
      ],
      "inputs": [
        "src/**",
        "package.json",
        "tsconfig.json"
      ]
    },
    "test": {
      "dependsOn": ["^build"],
      "outputs": ["coverage/**"],
      "inputs": [
        "src/**",
        "__tests__/**",
        "vitest.config.*"
      ]
    },
    "lint": {
      "outputs": [],
      "inputs": [
        "src/**",
        "eslint.config.*"
      ]
    },
    "dev": {
      "cache": false,
      "persistent": true
    }
  },
  "globalDependencies": [
    ".npmrc",
    "package-lock.json",
    "turbo.json"
  ]
}

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      # ランダムなポート番号を生成（40000-50000 の範囲）
      - name: Set random port
        id: set-port
        run: echo "port=$((40000 + RANDOM % 10000))" >> $GITHUB_OUTPUT
 
      - name: Run remote cache server
        uses: ./.github/actions/run-remote-cache-server
        with:
          remote_cache_s3_bucket_name: ${{ secrets.REMOTE_CACHE_S3_BUCKET_NAME }}
          remote_cache_role_arn: ${{ secrets.REMOTE_CACHE_ROLE_ARN }}
          remote_cache_port: ${{ steps.set-port.outputs.port }}
 
      - name: Lint
        run: npm run lint
 
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
 
      # 別のジョブでも同様にランダムポートを使用
      - name: Set random port
        id: set-port
        run: echo "port=$((40000 + RANDOM % 10000))" >> $GITHUB_OUTPUT
 
      # ... 以下同様

jobs:
  build-matrix:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image:
          - name: app
            remote-cache-port: 32001
          - name: api
            remote-cache-port: 32002
          - name: worker
            remote-cache-port: 32003
      max-parallel: 5
      fail-fast: false
 
    steps:
      - uses: actions/checkout@v4
 
      # マトリクスで定義した固定ポートを使用
      - name: Run remote cache server
        uses: ./.github/actions/run-remote-cache-server
        with:
          remote_cache_s3_bucket_name: ${{ secrets.REMOTE_CACHE_S3_BUCKET_NAME }}
          remote_cache_role_arn: ${{ secrets.REMOTE_CACHE_ROLE_ARN }}
          remote_cache_port: ${{ matrix.image.remote-cache-port }}
 
      - name: Build
        run: npm run build:${{ matrix.image.name }}

- name: Set up Docker Buildx
  uses: docker/setup-buildx-action@v3
  with:
    driver-opts: network=host  # localhost へのアクセスを許可

- name: Build and Push Docker Image
  uses: docker/build-push-action@v5
  with:
    context: .
    file: ./Dockerfile
    push: true
    build-args: |
      TURBO_API=${{ env.TURBO_API }}
      TURBO_TOKEN=${{ env.TURBO_TOKEN }}
      TURBO_TEAM=${{ env.TURBO_TEAM }}

# Dockerfile
FROM node:22-alpine AS builder
 
ARG TURBO_API
ARG TURBO_TOKEN
ARG TURBO_TEAM
 
WORKDIR /app
COPY . .
RUN npm ci
RUN npm run build  # turbo run build が実行され、Remote Cache が使用される

- name: Build and Push Docker Image
  uses: docker/build-push-action@v5
  with:
    context: .
    file: ./Dockerfile
    push: true
    # Docker レイヤーキャッシュ（GitHub Actions Cache を使用）
    cache-from: type=gha,scope=${{ matrix.image.name }}
    cache-to: type=gha,mode=max,scope=${{ matrix.image.name }}
    build-args: |
      # Turborepo Remote Cache
      TURBO_API=${{ env.TURBO_API }}
      TURBO_TOKEN=${{ env.TURBO_TOKEN }}
      TURBO_TEAM=${{ env.TURBO_TEAM }}

$ turbo run build
 
Tasks:    10 successful, 10 total
Cached:   8 cached, 10 total  # 10 タスク中 8 タスクがキャッシュヒット
Time:     15.234s

# ドライランでハッシュを確認
turbo run build --dry=json
 
# 出力される JSON で taskHash を確認
# 同じ入力であれば同じハッシュになるはず